From 4a5b8c7f20ddd58fe9ff5d063d3d3fce0690f5bc Mon Sep 17 00:00:00 2001 From: Matthew Creal Morgan Date: Fri, 24 Jul 2026 11:34:23 -0700 Subject: [PATCH] add ami-type var and set to AL2023 (#29) * add ami-type var and set to AL2023 * fix var * enable inline policy to avoid policy size limits * removed default true options --- README.md | 3 ++- main.tf | 28 ++++++++++++---------------- variables.tf | 6 ++++++ 3 files changed, 20 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index 9b59b4d..d0f3fdd 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Source | Version | |------|--------|---------| | [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git | tf-upgrade | -| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.15.1 | +| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.23.0 | ## Resources @@ -57,6 +57,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no | +| [ami\_type](#input\_ami\_type) | AMI type to use for the Karpenter node group | `string` | `"AL2023_x86_64_STANDARD"` | no | | [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | | [create\_spot\_service\_linked\_role](#input\_create\_spot\_service\_linked\_role) | Whether to create the service-linked role for EC2 Spot (required for Karpenter spot instances) | `bool` | `false` | no | diff --git a/main.tf b/main.tf index bfdc816..20b2712 100644 --- a/main.tf +++ b/main.tf @@ -1,6 +1,7 @@ locals { - amd_ami_family = "Bottlerocket" - amd_ami_alias = "bottlerocket@latest" + ami_type_family = upper(split("_", var.ami_type)[0]) + amd_ami_family = local.ami_type_family + amd_ami_alias = lower(format("%v@latest", local.amd_ami_family)) # Calculate the role name with prefix role_name_raw = format("%v%v-%v", local.prefixes["eks-role"], var.cluster_name, "karpenter") @@ -17,23 +18,20 @@ locals { rule_name_prefix = length(local.rule_name_raw) > local.max_rule_name_length ? substr(local.rule_name_raw, 0, local.max_rule_name_length) : local.rule_name_raw queue_name = format("%v%v", local.prefixes["eks-queue"], var.cluster_name) subnet_ids = try(tolist(var.subnets), []) - } # Replicating from here: https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/tree/master/modules/karpenter # Karpenter IRSA roles and policies module "karpenter_resources" { - source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.15.1" - - cluster_name = var.cluster_name - create_access_entry = true - create_instance_profile = true - create_node_iam_role = true - create_pod_identity_association = true - namespace = var.namespace - node_iam_role_name = local.node_iam_role_name - queue_name = local.queue_name - rule_name_prefix = local.rule_name_prefix + source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.23.0" + + cluster_name = var.cluster_name + enable_inline_policy = true + create_instance_profile = true + namespace = var.namespace + node_iam_role_name = local.node_iam_role_name + queue_name = local.queue_name + rule_name_prefix = local.rule_name_prefix # Attach additional IAM policies to the Karpenter node IAM role node_iam_role_additional_policies = { AmazonSSMManagedInstanceCore = format("arn:%v:iam::%v:%v", data.aws_arn.current.partition, "aws", "policy/AmazonSSMManagedInstanceCore") @@ -42,8 +40,6 @@ module "karpenter_resources" { CloudWatchAgentServerPolicy = format("arn:%v:iam::aws:%v", data.aws_arn.current.partition, "policy/CloudWatchAgentServerPolicy") } - - tags = var.tags } # Install Karpenter diff --git a/variables.tf b/variables.tf index 98c5fd5..ec5f5ce 100644 --- a/variables.tf +++ b/variables.tf @@ -97,3 +97,9 @@ variable "create_spot_service_linked_role" { type = bool default = false } + +variable "ami_type" { + description = "AMI type to use for the Karpenter node group" + type = string + default = "AL2023_x86_64_STANDARD" +}